feat(nvcf-cli): update allowedExtraKubernetesTypes on a registered cluster

Why

The cluster Helm validation policy is set at cluster registration. By design, the policy name is immutable after registration, but the allowed extra Kubernetes types can be updated. nvcf-cli currently exposes only cluster register (create) and a JWKS update, so there is no CLI path to update a registered cluster's allowedExtraKubernetesTypes.

As part of PR #1867 (CLI-only), passing --validation-policy / --validation-extra-type together with --ignore-existing against an already-registered cluster is now rejected, because that path only refreshes JWKS and would otherwise silently drop the requested policy. This issue tracks adding a real update path so operators can adjust allowed types without deleting and re-registering the cluster.

What changed

Not yet implemented. Proposed: add a CLI command (for example cluster update-validation-policy, or an equivalent update subcommand) that:

• updates allowedExtraKubernetesTypes only
• rejects any attempt to change the policy name; the name must match the stored value
• uses cluster-side group/version/kind/resource (four-part) types, consistent with cluster register

Dependencies

Depends on the control-plane cluster update endpoint that accepts helmValidationPolicy.allowedExtraKubernetesTypes (PUT of the account cluster resource). That endpoint is backend work owned outside this repo and must exist before the CLI command can function end to end.

References

Relates to #880

No files or tests are named. Start by locating the existing cluster register and JWKS update CLI commands, then review the control-plane cluster update endpoint contract. Done means a command updates only allowedExtraKubernetesTypes, rejects policy-name changes, uses four-part cluster-side types, and works once the dependent endpoint exists.